Integrated Assurance vs. Combined Assurance

Combined Assurance and Patrick M. Hayes’s Integrated Assurance® operating model address related problems from different perspectives. Combined Assurance generally coordinates assurance activities across management, risk and compliance, internal audit, external assurance and other providers. Its purpose is to give leadership a more coherent view of coverage, gaps and whether important risks are appropriately managed. Patrick’s operating model connects that assurance information with the broader enterprise: business dependencies, controls, technology, operational consequences, meaningful recovery and financial exposure. The distinction is what gets integrated. Combined Assurance primarily integrates assurance activity and coverage; Integrated Assurance integrates the operating context in which assurance decisions are made. These are conceptual emphases, not absolute boundaries for every implementation. The approaches can work together, and adopting Integrated Assurance does not require dismantling an established Combined Assurance program.

By Patrick M. Hayes · A primary-source explanation of his specific Integrated Assurance® operating model.

Organizations receive assurance from many sources: operational management, risk management, compliance, cybersecurity and technology functions, internal audit, external audit, regulators, independent specialists and other assurance providers.

Combined Assurance seeks to coordinate those activities so an organization can reduce unnecessary duplication, identify assurance gaps and give leadership a more coherent view of whether important risks are being appropriately managed. It is not limited to internal audit and is not simply an audit methodology.

The IIA’s Three Lines Model helps explain the roles and relationships of governance, management, internal audit and external assurance providers. It is related to assurance coordination, but it is not identical to Combined Assurance: one clarifies roles and accountability, while the other coordinates assurance activity and coverage.

Further context: The Institute of Internal Auditors on Combined Assurance.

Patrick M. Hayes’s Integrated Assurance® is an enterprise operating model for connecting decisions across governance, technology, cybersecurity, operations, risk and financial resilience. It brings those perspectives together around a shared understanding of what the business depends on, how it creates value and what could interrupt that value.

This is the canonical definition used on this site. Patrick developed this specific operating model; he did not create Combined Assurance or the generic phrase integrated assurance. His model connects expertise and accountability across the enterprise rather than renaming assurance coordination.

Different functions often possess different pieces of the organization’s risk picture. Internal audit may understand assurance gaps; cybersecurity understands technical exposure; risk management understands enterprise risk; operations understands business dependencies; finance understands financial tolerance; legal understands obligations; and technology teams understand systems and architecture.

No single function necessarily sees the entire consequence. Both approaches recognize the cost of fragmentation, but respond from different operating perspectives: coordinating assurance about risk and connecting that knowledge to the business decisions it informs.

A fictional example

An organization relies on a critical software-as-a-service (SaaS) provider for an important business process. Under Combined Assurance, leadership may ask:

• Who evaluated the vendor?
• What assurance has been obtained?
• Have security and compliance requirements been assessed?
• Has internal audit reviewed third-party risk management?
• Are there assurance gaps or duplicated reviews?

Patrick’s Integrated Assurance extends that conversation:

• Which business processes depend on the provider?
• What happens if the provider becomes unavailable?
• How long can the business operate without it?
• Is there an alternative?
• Who owns the recovery decision?
• What contractual obligations result from an outage?
• What does prolonged disruption cost?
• What portion of that consequence can be financed or transferred?

Combined Assurance helps leadership understand whether the dependency has been appropriately assured. Integrated Assurance helps leadership understand what the dependency means to the business. Neither perspective alone solves every problem; both require credible evidence and accountable decisions.

Security → Liability → Recovery

The established Integrated Assurance Risk Value Chain connects security to obligations, operational disruption, meaningful recovery and financial impact. Assurance about a security control is important; leadership also needs to understand the consequences if that control or its dependencies fail.

The relationships are interdependent. Recovery capability can change financial exposure, and contractual obligations can shape response priorities. This is the existing Risk Value Chain, not a new assurance model or scoring sequence.

Leadership needs more than confidence that individual controls have been assessed. It needs enough information to make decisions when assumptions fail: which operations matter, what they depend on and what it takes to maintain or restore them during disruption.

A restored system is not necessarily a restored business service. Meaningful recovery also depends on people, suppliers, obligations and financial capacity. Patrick’s operating model connects these perspectives to the ability to continue creating value.

This does not mean Combined Assurance ignores resilience. The distinction remains the scope and purpose of this particular operating model.

Yes.

A mature Combined Assurance capability can provide valuable visibility into assurance coverage, control effectiveness, risk ownership, gaps, findings and management actions. Integrated Assurance can place that information in the broader context of business dependencies, technology architecture, operational consequence, recovery and financial exposure.

Combined Assurance can strengthen what the organization knows about its controls and risks. Integrated Assurance helps leadership understand what that knowledge means for the business.

No.

Organizations with established Combined Assurance programs do not need to dismantle them to adopt Integrated Assurance. Existing assurance structures can become valuable components of the broader operating model.

Patrick’s model extends decision context rather than replacing internal audit, GRC or other established assurance disciplines. Coordinated assurance and clear accountability remain important.

GRC helps organize governance, risk management and compliance. Combined Assurance coordinates assurance. Integrated Assurance connects those capabilities to the broader operating enterprise. This is orientation, not a rigid boundary: these disciplines can overlap and work together.

Integrated Assurance is the operating model. The Integrated Assurance Maturity Model (IAMM®) is the maturity model used to examine the development of that capability.

The dedicated IAMM reference explains the existing six organizational domains and five maturity levels. Domain maturity is considered separately; it is not a universal assurance score or proof of compliance.

Patrick M. Hayes is the author of Integrated Assurance: Unified Risk Strategy and developer of the specific operating model described here. Relevant Impact develops its practical decision-making context. This page is not a claim of authorship of Combined Assurance or the broader practice of assurance integration.